Copilot cloud agent and other AI agents
Why Tier 2
Opens pull requests and comments, which is data-plane write. Its real tier is the tokens, secrets and MCP tools it is given.
An AI agent that takes an issue or prompt, works in its own environment and opens a pull request. It reads text that outsiders can write, and acts with the tools and MCP servers it is configured with.
Available on: Free (with a Copilot plan), Team (with a Copilot plan), Enterprise Cloud, EMU (organization repositories only). Source
Attack path
Its inputs are issues, comments and files, so prompt injection is the entry point. An agent with broad MCP tools or secrets in its environment can be talked into reading private data or pushing changes it was never asked for.
Mitigations
- Keep its output behind normal review
- Treat the tokens and MCP servers it is given as grants to review like any other
Detect
Alert on copilot.cfb_org_settings_changed, mcp_registry.allowlist_add_server, mcp_registry.settings_update in the audit log (the closest events GitHub logs).